An Open Catalog Needs Guardrails, Not a Free-for-All

"Open" is the easy part

Anyone can stand up a store that lets developers upload code. The hard part of an open catalog is not letting it in — it is what happens after: who reviews submissions, how harmful content is caught, what stops abuse, and how users know they can trust what they tap. A runtime that hosts third-party mini-programs inherits the same trust-and-safety load as an app store, and the model for doing it well already exists at scale. WeChat runs 4.3M+ mini-programs, 945M MAU, and 5M+ developers under a documented operating spec — proof that an open catalog can be both open and governed.

What governance actually covers

Governance is four jobs, and skipping any one of them is how catalogs get a reputation they never recover from.

Governance layer	What it enforces	What breaks without it
Submission review	Real identity, category fit, licenses (资质) checked before publish	Fraudulent or unlicensed services go live
Content security	Text/image/audio scan for illegal, porn, violence, political-risk content	UGC and live content leak harm
Abuse controls	Anti-share-spam, anti-刷量 (fake orders), anti-网赚, anti-外挂	Incentive loops and bots drown real users
Trust signals	Complaint channels, ratings, transparent takedown	Users have no recourse; the platform loses credibility

Review before publish, not after

WeChat's operating spec requires a verifiable body (主体) for every mini-program, screens names/logos/trademarks to avoid brand confusion and infringement, enforces category consistency (the service must match the registered category and tag), and rejects hidden categories or homogenized clones. Financial, medical, and government services must present the right licenses or they are refused. The principle is simple: identity and scope are established at the door, not discovered after harm. A runtime embedding a catalog should inherit the same gate — every mini-program carries a verified developer and a declared, audited scope.

Content security is a built-in control

For user-generated and live content, WeChat exposes a content-security API (msgSecCheck for text, mediaCheckAsync for image/audio) built on a 100k-level sensitive dictionary and deep-learning models, with a hard caveat: automation does not absolve the platform — the docs explicitly tell developers to keep human review for REVIEW-flagged and sampled PASS content. A governed catalog applies the same layering: server-side pre-publish scanning plus sampled human review, so harmful content is caught at the edge rather than after it trends.

Abuse controls keep the catalog usable

The operating spec defines and penalizes share-spam (forced, hinted, or rewarded sharing), 刷量 (fake votes, fans, orders), 网赚 (paid-forward loops), 外挂 (cheats/plugins), IP infringement, and illegal multi-level distribution. Penalties scale from limiting share/search ability to takedown and account ban. This is the unglamorous machinery that keeps an open catalog from becoming a spam engine — and it must be encoded as platform policy, not left to each developer's discretion.

Takedown and accountability at scale

Governance is only credible if violations are actually removed. WeChat's 珊瑚安全 (Coral Security) team publishes monthly takedown notices; in a single 2026 monthly cycle it removed dozens of non-compliant mini-drama programs and, in one May sweep, over 2,800 mini-dramas with harmful child portrayals. Recurring, public enforcement signals to developers that the rules are live and to users that the catalog is policed.

Where Cross Mini App fits

Cross Mini App treats governance as part of the runtime, not an afterthought bolted on. Every mini-program in the catalog is reviewed for scope and identity, scanned before publish, covered by abuse and complaint controls, and subject to takedown — so a host app can open an open catalog without inheriting an ungoverned one. "Open" without guardrails is just risk shifted onto the user; the runtime's job is to absorb that risk so the host does not have to.